Unauthenticated visitors can manipulate checkout fields to escalate accounts to administrator status in WooCommerce sites using plugin versions up to 10.8.0.
Microsoft patches a critical vulnerability in ASP.NET Core versions 8 through 11 that allows unauthorized network tampering via HTTP request smuggling.
A severe stored cross-site scripting vulnerability in Adobe Commerce and Magento Open Source requires immediate attention to prevent session hijacking.
A critical heap overflow in Windows Text Shaping allows remote attackers to run code on affected devices without authentication.
Docker patched a critical flaw that let attackers use tokens they controlled to impersonate users and tamper with container images in the registry.
A high-severity flaw in Risesoft-y9 digital infrastructure allows attackers to write arbitrary files, potentially leading to remote code execution without authentication.
A critical flaw in Obsidian-TC versions before 1.3.1 allows attackers with valid tokens to access, modify, or delete data in any configured vault without proper authorization checks.
Booz Allen reports frontier AI models achieved all eight attack goals in an isolated industrial control testbed, including moving a robotic arm.
A CVSS 9.2 server-side request forgery in Crawl4AI versions before 0.9.4 allows API users to access private cloud metadata and internal network resources.
A severe vulnerability in Linksys E1700 firmware allows attackers to execute commands remotely, with no vendor patch currently available.
Threat groups like Qilin and Settra are using an authentication bypass in Palo Alto Networks software to enter internal networks through trusted remote access services without detection.
Unpatched Agnaistic Agnai installations expose fixed admin passwords and JWT secrets, allowing remote attackers to seize full control of the server.
The NVD rates CVE-2026-62076 as critical with a 9.8 score, affecting all Kalles CMS versions up to 1.1.7.1 through PHP object injection.
A critical injection flaw in openapi-typescript-codegen allows attackers to run arbitrary JavaScript via malicious API definitions, risking full system compromise.
A critical vulnerability in WineShop allows remote attackers to inject PHP objects without authentication, risking full server compromise for unpatched stores.
The interim chief financial officer left the WordPress parent company weeks after a boardroom shakeup, signaling ongoing leadership instability.
Internal documents show TikTok slashed immediate advertiser ban triggers from 37 to 13 last fall, a policy shift linked to a significant rise in scam campaigns.
Unauthenticated attackers can delete server files and execute code via a critical path traversal bug in the PPOM WooCommerce plugin versions up to 34.0.10.
A critical flaw in the dot-access npm library allows attackers to run operating system commands on Node.js servers through crafted inputs.
A critical OS command injection flaw in the Ruby image_optimizer gem allows attackers to run arbitrary system commands via crafted file paths.
A critical vulnerability in Dromara Skyeye allows attackers to run scripts on servers without logging in.
A critical flaw in IBM’s access management software allows remote attackers to bypass login screens, requiring immediate vendor updates.
Federal agencies must mitigate CVE-2015-3306 in ProFTPD by October 11 to prevent unauthorized file access exploited by threat actors.
CISA mandates patching for CVE-2025-5477 in ISC BIND by Oct 11. Failure to mitigate risks remote denial-of-service attacks via TKEY queries.